Can I use GnuPG to verify that a file is unmodified and comes from the correct sender?

Let's take a simple use case:

  1. I have this file with some important content, let's say it is in a .tar.gz file.
  2. I sign this file with something like GnuPG
  3. I send this file to another guy.
  4. The other guy likes to know that the file is not modified by a man in the middle, and that I was the sender. So he uses the same tool to verify that the file is ok.

Can a tool like GnuPG help out here?

Note: The two computers are Linux based, and command line is nice :)


This is what I did.


sudo aptitude install gnupg

Generate a key and export it:

gpg --gen-key 
gpg --export -a "Johan Simonsson" > public.key

Gave the other guy the public.key on a usb-stick

Created a test file to play with and signed it:

tar -cvzf test.tar.gz ~/.vim
gpg --output test.sig --detach-sig test.tar.gz
tar -cvzf file.tar.gz test.sig test.tar.gz

The other guy imports the key that I gave him on a usb-stick.

gpg --import public.key

Then I email file.tar.gz to the other guy, and he can verify the files I send to him with something like this:

tar -xvzf file.tar.gz
gpg --verify test.sig test.tar.gz

And this seems like a ok solution (since the keys are not all over the place)

Note: Or we can use the PGP servers to store the keys, but that is another topic.

1 Answer 1


Yes, Use GPG's detached signature feature. It will create a separate file containing the signature and the file can be verified using that signature.

To sign:

gpg --output yourfile.sig --detach-sig yourfile.tgz

To Verify:

gpg --verify yourfile.sig yourfile.tgz
  • Looks like a good start, but when I send the .sig and the .tgz to the other PC. I get a "gpg: Can't check signature: public key not found" so I guess that I need to send him a public key to start with?
    – Johan
    May 23, 2011 at 12:54
  • 1
    Yes, that is how GPG works. You share your public key with others (you can put it on a keyserver if you like) and other people share their public key with you.
    – Bandit
    May 23, 2011 at 13:10
  • There seems to be a possibility to export and import keys as well, and if you send that key via another medium like in a usb-key in paper mail that would probably be ok as well. (If you don't have any ok keys in a server)
    – Johan
    May 23, 2011 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.